The era after the password<\/h2><\/h2><\/div>Traditional passwords are inferior in several ways: they are susceptible to phishing, are often considered weak or are used multiple times – which makes them the main target of attacks. Microsoft’s strategy for greater security and relief for admins: away from passwords and towards passwordless passkeys.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
<\/h2>\nWhat are passkeys – and why are they more secure?<\/h2>\n<\/h2><\/h2><\/div><\/div><\/div>A passkey is not a password in the traditional sense, but a cryptographic key pair consisting of a public and a private key. The public key remains on the server, the private key remains securely stored on the device, typically in the secure hardware environment – TPM, Secure Enclave or app container.<\/p>\n
Safety benefits:<\/b><\/p>\n<\/div>- <\/i><\/span>\n
No server stores sensitive private data – hackers only receive ineffective public keys.<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Implemented biometrics (fingerprint, facial recognition) or PIN protects against unauthorized use.<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Natural protection against phishing: Private keys are never transmitted and cannot be intercepted.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>
![\"The](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/07\/BeiometrischerLogin-600x449.jpg\" "\\"BeiometrischerLogin\\"")
<\/span><\/div><\/div><\/div><\/div><\/div><\/h2>\nHow passkey login works in practice<\/h2>\n<\/h2>\n<\/h2>\n<\/h2><\/h2><\/div><\/p>\n
Logging in is intuitive and lightning fast: users click on “Use passkey” in Microsoft 365 and confirm by fingerprint, facial recognition or PIN – on the same or a synchronized device. The challenge is resolved by the private key and sent back to the server.<\/div>\nFor multi-device scenarios (e.g. laptop and iPhone), systems can be synchronized or linked via QR code.<\/div>\n<\/div><\/div><\/div><\/h2>\nMicrosoft’s integration of passkeys – an overview<\/h2>\n<\/h2><\/h2><\/div><\/div><\/div>![\"In](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/07\/Passkey_M365-600x449.jpg\" "\\"Passkey_M365\\"")
<\/span><\/div><\/div><\/div>Microsoft is integrating Passkeys in the Entra ID environment – the former Azure AD. The technology is already available and can be configured.<\/p>\n
Supported authenticator types:<\/b><\/p>\n<\/div>- <\/i><\/span>Microsoft Authenticator app (iOS\/Android) for registration via passkeys<\/div><\/li>
- <\/i><\/span>Windows Hello on modern Windows devices<\/div><\/li>
- <\/i><\/span>FIDO2 Security Keys (e.g. YubiKey)<\/div><\/li>
- <\/i><\/span>\n
Browser with passkey support (Edge, Chrome, Safari)<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
<\/h2>\nAdvantages for companies and Microsoft admins<\/h2>\n<\/h2><\/h2><\/div>There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div>- <\/i><\/span>Maximum security – public-private key pairs are highly resistant to hacker attacks and phishing<\/div><\/li>
- <\/i><\/span>Less support effort – no password reset, fewer helpdesk tickets<\/div><\/li>
- <\/i><\/span>Better UX – fast, intuitive authentication without entering a password<\/div><\/li>
- <\/i><\/span>Efficiency gains – time savings due to less password management and complexity<\/div><\/li>
- <\/i><\/span>Compliance boost – modern authentication procedures underpin zero trust strategies<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
<\/h2>\nCurrent status & roadmap<\/h2>\n<\/h2>\n<\/h2><\/h2><\/div>There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div>- <\/i><\/span>Public preview available since the beginning of 2024<\/div><\/li>
- <\/i><\/span>\n
Globally available planned for 2nd half of 2025<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Upcoming functions:<\/p>\n
\n- Integration in local AD environments (hybrid scenarios)<\/span><\/li>\n
- Self-service passkey registration & recovery<\/li>\n
- Management via Conditional Access & Entra Policies <\/li>\n<\/ul>\n<\/div><\/li><\/ul>
<\/p>\n
Current research (e.g. device bound vs. synced credentials) shows that passkeys offer a high level of security, but special care is required when synchronizing across multiple devices – the risk here lies with the passkey provider.<\/div>\nOn June 27, 2025, Microsoft released the Windows 11 Insider Preview Build 26120.4520 (KB5060834) in the beta channel. This contains an important milestone for the passwordless future: the integration of third-party credential managers directly into the Windows login settings.<\/div>\n<\/div>\nWhat does that mean in concrete terms?<\/p>\n
Users can go to <\/span>Settings > Passkeys > Advanced options<\/i> <\/b>to activate the so-called Plugin Credential Manager. <\/span><\/p>\n\n- Prerequisite: Authentication via Windows Hello (face, fingerprint or PIN).<\/li>\n
- The function is currently being tested with the beta version of 1Password, with other providers to follow.<\/li>\n<\/ul>\n
<\/p>\n
<\/div>\n<\/div><\/p>\n
What’s new? – Briefly summarized!<\/h3>\n
Login to websites<\/strong>:
\n<\/span>Passkeys from the third-party vault (e.g. 1Password) can be used directly to log in – one click, one authentication, done.
\n
\nSaving new passkeys:
\n<\/b><\/span>When visiting passkey-enabled websites, new keys can be created and saved in the Credential Manager – also secured by Windows Hello.<\/span><\/p>\n
Traditional passwords are inferior in several ways: they are susceptible to phishing, are often considered weak or are used multiple times – which makes them the main target of attacks. Microsoft’s strategy for greater security and relief for admins: away from passwords and towards passwordless passkeys.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
<\/h2>\nWhat are passkeys – and why are they more secure?<\/h2>\n<\/h2><\/h2><\/div><\/div><\/div>A passkey is not a password in the traditional sense, but a cryptographic key pair consisting of a public and a private key. The public key remains on the server, the private key remains securely stored on the device, typically in the secure hardware environment – TPM, Secure Enclave or app container.<\/p>\n
Safety benefits:<\/b><\/p>\n<\/div>- <\/i><\/span>\n
No server stores sensitive private data – hackers only receive ineffective public keys.<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Implemented biometrics (fingerprint, facial recognition) or PIN protects against unauthorized use.<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Natural protection against phishing: Private keys are never transmitted and cannot be intercepted.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>
<\/span><\/div><\/div><\/div><\/div><\/div><\/h2>\nHow passkey login works in practice<\/h2>\n<\/h2>\n<\/h2>\n<\/h2><\/h2><\/div><\/p>\n
Logging in is intuitive and lightning fast: users click on “Use passkey” in Microsoft 365 and confirm by fingerprint, facial recognition or PIN – on the same or a synchronized device. The challenge is resolved by the private key and sent back to the server.<\/div>\nFor multi-device scenarios (e.g. laptop and iPhone), systems can be synchronized or linked via QR code.<\/div>\n<\/div><\/div><\/div><\/h2>\nMicrosoft’s integration of passkeys – an overview<\/h2>\n<\/h2><\/h2><\/div><\/div><\/div><\/span><\/div><\/div><\/div>Microsoft is integrating Passkeys in the Entra ID environment – the former Azure AD. The technology is already available and can be configured.<\/p>\n
Supported authenticator types:<\/b><\/p>\n<\/div>- <\/i><\/span>Microsoft Authenticator app (iOS\/Android) for registration via passkeys<\/div><\/li>
- <\/i><\/span>Windows Hello on modern Windows devices<\/div><\/li>
- <\/i><\/span>FIDO2 Security Keys (e.g. YubiKey)<\/div><\/li>
- <\/i><\/span>\n
Browser with passkey support (Edge, Chrome, Safari)<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
<\/h2>\nAdvantages for companies and Microsoft admins<\/h2>\n<\/h2><\/h2><\/div>There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div>- <\/i><\/span>Maximum security – public-private key pairs are highly resistant to hacker attacks and phishing<\/div><\/li>
- <\/i><\/span>Less support effort – no password reset, fewer helpdesk tickets<\/div><\/li>
- <\/i><\/span>Better UX – fast, intuitive authentication without entering a password<\/div><\/li>
- <\/i><\/span>Efficiency gains – time savings due to less password management and complexity<\/div><\/li>
- <\/i><\/span>Compliance boost – modern authentication procedures underpin zero trust strategies<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
<\/h2>\nCurrent status & roadmap<\/h2>\n<\/h2>\n<\/h2><\/h2><\/div>There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div>- <\/i><\/span>Public preview available since the beginning of 2024<\/div><\/li>
- <\/i><\/span>\n
Globally available planned for 2nd half of 2025<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Upcoming functions:<\/p>\n
\n- Integration in local AD environments (hybrid scenarios)<\/span><\/li>\n
- Self-service passkey registration & recovery<\/li>\n
- Management via Conditional Access & Entra Policies <\/li>\n<\/ul>\n<\/div><\/li><\/ul>
<\/p>\n
Current research (e.g. device bound vs. synced credentials) shows that passkeys offer a high level of security, but special care is required when synchronizing across multiple devices – the risk here lies with the passkey provider.<\/div>\nOn June 27, 2025, Microsoft released the Windows 11 Insider Preview Build 26120.4520 (KB5060834) in the beta channel. This contains an important milestone for the passwordless future: the integration of third-party credential managers directly into the Windows login settings.<\/div>\n<\/div>\nWhat does that mean in concrete terms?<\/p>\n
Users can go to <\/span>Settings > Passkeys > Advanced options<\/i> <\/b>to activate the so-called Plugin Credential Manager. <\/span><\/p>\n\n- Prerequisite: Authentication via Windows Hello (face, fingerprint or PIN).<\/li>\n
- The function is currently being tested with the beta version of 1Password, with other providers to follow.<\/li>\n<\/ul>\n
<\/p>\n
<\/div>\n<\/div><\/p>\n
What’s new? – Briefly summarized!<\/h3>\n
Login to websites<\/strong>:
\n<\/span>Passkeys from the third-party vault (e.g. 1Password) can be used directly to log in – one click, one authentication, done.
\n
\nSaving new passkeys:
\n<\/b><\/span>When visiting passkey-enabled websites, new keys can be created and saved in the Credential Manager – also secured by Windows Hello.<\/span><\/p>\n
What are passkeys – and why are they more secure?<\/h2>\n<\/h2><\/h2><\/div><\/div><\/div>A passkey is not a password in the traditional sense, but a cryptographic key pair consisting of a public and a private key. The public key remains on the server, the private key remains securely stored on the device, typically in the secure hardware environment – TPM, Secure Enclave or app container.<\/p>\n
Safety benefits:<\/b><\/p>\n<\/div>- <\/i><\/span>\n
No server stores sensitive private data – hackers only receive ineffective public keys.<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Implemented biometrics (fingerprint, facial recognition) or PIN protects against unauthorized use.<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Natural protection against phishing: Private keys are never transmitted and cannot be intercepted.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>
<\/span><\/div><\/div><\/div><\/div><\/div><\/h2>\nHow passkey login works in practice<\/h2>\n<\/h2>\n<\/h2>\n<\/h2><\/h2><\/div><\/p>\n
Logging in is intuitive and lightning fast: users click on “Use passkey” in Microsoft 365 and confirm by fingerprint, facial recognition or PIN – on the same or a synchronized device. The challenge is resolved by the private key and sent back to the server.<\/div>\nFor multi-device scenarios (e.g. laptop and iPhone), systems can be synchronized or linked via QR code.<\/div>\n<\/div><\/div><\/div><\/h2>\nMicrosoft’s integration of passkeys – an overview<\/h2>\n<\/h2><\/h2><\/div><\/div><\/div><\/span><\/div><\/div><\/div>Microsoft is integrating Passkeys in the Entra ID environment – the former Azure AD. The technology is already available and can be configured.<\/p>\n
Supported authenticator types:<\/b><\/p>\n<\/div>- <\/i><\/span>Microsoft Authenticator app (iOS\/Android) for registration via passkeys<\/div><\/li>
- <\/i><\/span>Windows Hello on modern Windows devices<\/div><\/li>
- <\/i><\/span>FIDO2 Security Keys (e.g. YubiKey)<\/div><\/li>
- <\/i><\/span>\n
Browser with passkey support (Edge, Chrome, Safari)<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
<\/h2>\nAdvantages for companies and Microsoft admins<\/h2>\n<\/h2><\/h2><\/div>There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div>- <\/i><\/span>Maximum security – public-private key pairs are highly resistant to hacker attacks and phishing<\/div><\/li>
- <\/i><\/span>Less support effort – no password reset, fewer helpdesk tickets<\/div><\/li>
- <\/i><\/span>Better UX – fast, intuitive authentication without entering a password<\/div><\/li>
- <\/i><\/span>Efficiency gains – time savings due to less password management and complexity<\/div><\/li>
- <\/i><\/span>Compliance boost – modern authentication procedures underpin zero trust strategies<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
<\/h2>\nCurrent status & roadmap<\/h2>\n<\/h2>\n<\/h2><\/h2><\/div>There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div>- <\/i><\/span>Public preview available since the beginning of 2024<\/div><\/li>
- <\/i><\/span>\n
Globally available planned for 2nd half of 2025<\/p>\n<\/div><\/li>
- <\/i><\/span>\n
Upcoming functions:<\/p>\n
\n- Integration in local AD environments (hybrid scenarios)<\/span><\/li>\n
- Self-service passkey registration & recovery<\/li>\n
- Management via Conditional Access & Entra Policies <\/li>\n<\/ul>\n<\/div><\/li><\/ul>
<\/p>\n
Current research (e.g. device bound vs. synced credentials) shows that passkeys offer a high level of security, but special care is required when synchronizing across multiple devices – the risk here lies with the passkey provider.<\/div>\nOn June 27, 2025, Microsoft released the Windows 11 Insider Preview Build 26120.4520 (KB5060834) in the beta channel. This contains an important milestone for the passwordless future: the integration of third-party credential managers directly into the Windows login settings.<\/div>\n<\/div>\nWhat does that mean in concrete terms?<\/p>\n
Users can go to <\/span>Settings > Passkeys > Advanced options<\/i> <\/b>to activate the so-called Plugin Credential Manager. <\/span><\/p>\n\n- Prerequisite: Authentication via Windows Hello (face, fingerprint or PIN).<\/li>\n
- The function is currently being tested with the beta version of 1Password, with other providers to follow.<\/li>\n<\/ul>\n
<\/p>\n
<\/div>\n<\/div><\/p>\n
What’s new? – Briefly summarized!<\/h3>\n
Login to websites<\/strong>:
\n<\/span>Passkeys from the third-party vault (e.g. 1Password) can be used directly to log in – one click, one authentication, done.
\n
\nSaving new passkeys:
\n<\/b><\/span>When visiting passkey-enabled websites, new keys can be created and saved in the Credential Manager – also secured by Windows Hello.<\/span><\/p>\n
A passkey is not a password in the traditional sense, but a cryptographic key pair consisting of a public and a private key. The public key remains on the server, the private key remains securely stored on the device, typically in the secure hardware environment – TPM, Secure Enclave or app container.<\/p>\n
Safety benefits:<\/b><\/p>\n<\/div> No server stores sensitive private data – hackers only receive ineffective public keys.<\/p>\n<\/div><\/li> Implemented biometrics (fingerprint, facial recognition) or PIN protects against unauthorized use.<\/p>\n<\/div><\/li> Natural protection against phishing: Private keys are never transmitted and cannot be intercepted.<\/p>\n<\/div><\/li><\/ul><\/div><\/div> <\/p>\n Microsoft is integrating Passkeys in the Entra ID environment – the former Azure AD. The technology is already available and can be configured.<\/p>\n Supported authenticator types:<\/b><\/p>\n<\/div> Browser with passkey support (Edge, Chrome, Safari)<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div> There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div> There are clear advantages for security managers and IT managers:<\/b><\/span><\/p>\n<\/div> Globally available planned for 2nd half of 2025<\/p>\n<\/div><\/li> Upcoming functions:<\/p>\n <\/p>\n What does that mean in concrete terms?<\/p>\n Users can go to <\/span>Settings > Passkeys > Advanced options<\/i> <\/b>to activate the so-called Plugin Credential Manager. <\/span><\/p>\n <\/p>\n <\/p>\n Login to websites<\/strong>:<\/span><\/div><\/div><\/div><\/div><\/div><\/h2>\n
How passkey login works in practice<\/h2>\n
<\/h2>\n
<\/h2>\n
<\/h2><\/h2><\/div>
<\/h2>\n
Microsoft’s integration of passkeys – an overview<\/h2>\n
<\/h2><\/h2><\/div><\/div><\/div>
<\/span><\/div><\/div><\/div><\/h2>\n
Advantages for companies and Microsoft admins<\/h2>\n
<\/h2><\/h2><\/div>
<\/h2>\n
Current status & roadmap<\/h2>\n
<\/h2>\n
<\/h2><\/h2><\/div>
\n
\n
What’s new? – Briefly summarized!<\/h3>\n
\n<\/span>Passkeys from the third-party vault (e.g. 1Password) can be used directly to log in – one click, one authentication, done.
\n
\nSaving new passkeys:
\n<\/b><\/span>When visiting passkey-enabled websites, new keys can be created and saved in the Credential Manager – also secured by Windows Hello.<\/span><\/p>\n
![](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/07\/NoPasswords-600x449.jpg\" "\\"NoPasswords\\"")
<\/span><\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":21,"featured_media":11433,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[333],"tags":[318,270,319,317],"class_list":["post-11449","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-en_it_security","tag-it-security-en","tag-microsoft-en","tag-microsoft-entra-en","tag-microsoft-security"],"yoast_head":"\n